Secure storage of hashes within a distributed ledger
The present disclosure describes systems and methods for verification of data, including updates to applications, firmware, operating system libraries or other such data. This may be done through the use of a distributed ledger system to provide a secure anti-tamper mechanism for software and firmware updates that may be independently accessed and verified by any device. Distributed ledger systems, sometimes referred to as block chains, are online data storage systems with cryptography-based architecture providing links between records stored in “blocks”. Each block contains a hash of a previous block, providing a chain of linked blocks that are immutable: any alteration of a record changes the hash of the subsequent block, which changes the hash of the next subsequent block, etc. Accordingly, any modification of data is easily detectable.
1. A method for distributed ledger-based secure data verification, comprising:
generating, by a processor of a first device, a cryptographic hash of one or more data files in a storage device maintained by the first device;
appending, by the first device, the first cryptographic hash to a distributed immutable ledger;
receiving, by the first device from a second device, a second cryptographic hash of a second copy of the one or more data files in a storage device maintained by the second device, and a device identifier of the second device;
retrieving, by the first device from a third device operating as a full node for the distributed immutable ledger, a portion of the distributed immutable ledger comprising the first cryptographic hash;
extracting from the retrieved portion, by the first device, the first cryptographic hash;
comparing, by the first device, the first cryptographic hash and the second cryptographic hash; and
responsive to the comparison indicating that the first cryptographic hash and the second cryptographic hash match:
recording the device identifier of the second device as trusted in a device identification database maintained by the first device by appending the device identifier of the second device to the distributed immutable ledger.
2. The method of claim 1 , wherein generating the cryptographic hash further comprises receiving, from a service provider, a new version of a firmware file, system file, library, or application.
3. The method of claim 1 , wherein appending the first cryptographic hash to the distributed immutable ledger further comprises transmitting the first cryptographic hash to the third device.
4. The method of claim 3 , wherein transmitting the first cryptographic hash to the third device causes the third device to generate a block of the distributed immutable ledger comprising the first cryptographic hash.
5. The method of claim 4 , wherein retrieving the portion of the distributed immutable ledger further comprises requesting the block.
6. The method of claim 1 , wherein comparing the first cryptographic hash and the second cryptographic hash comprises performing a bitwise exclusive-or comparison of the first cryptographic hash and the second cryptographic hash.
7. The method of claim 1 , wherein appending the device identifier of the second device to the distributed immutable ledger further comprises transmitting the device identifier of the second device to the third device.
8. A system for distributed ledger-based secure data verification, comprising:
a first device comprising a network interface in communication with a second device and a third device, a storage device comprising one or more data files, and a processor;
wherein the processor is configured to:
generate a cryptographic hash of the one or more data files in the storage device, and
append the first cryptographic hash to a distributed immutable ledger;
wherein the network interface is configured to:
receive, from the second device, a second cryptographic hash of a second copy of the one or more data files in a storage device maintained by the second device, and a device identifier of the second device, and
retrieve, from a third device operating as a full node for the distributed immutable ledger, a portion of the distributed immutable ledger comprising the first cryptographic hash;
wherein the processor is further configured to:
extract the first cryptographic hash from the retrieved portion,
compare the first cryptographic hash and the second cryptographic hash, and
responsive to the comparison indicating that the first cryptographic hash and the second cryptographic hash match:
recording the device identifier of the second device as trusted in a device identification database maintained by the first device by appending the device identifier of the second device to the distributed immutable ledger.
9. The system of claim 8 , wherein the network interface is further configured to receive, from a service provider, a new version of a firmware file, system file, library, or application.
10. The system of claim 8 , wherein the processor is further configured to append the first cryptographic hash to the distributed immutable ledger by transmitting the first cryptographic hash to the third device.
11. The system of claim 10 , wherein the transmission of the first cryptographic hash to the third device causes the third device to generate a block of the distributed immutable ledger comprising the first cryptographic hash.
12. The system of claim 11 , wherein the network interface is further configured to retrieve the portion of the distributed immutable ledger by requesting the block.
13. The system of claim 8 , wherein the processor is further configured to perform a bitwise exclusive-or comparison of the first cryptographic hash and the second cryptographic hash.
14. The system of claim 8 , wherein the network interface is further configured to transmit the device identifier of the second device to the third device.